When I run a search on google and then click on a link, the browser
does not go to the correct page.  Instead, it goes to, for example,
http://get-search.cc/se.php?qq=pacific+poker  or a similar variant.

I keep deleting the temporary internet files and cookies but the
problem persists.  I am using Explorer 6 and Norton Systemworks.

Do I need to enhance security somehow?  How can I locate the cookie
that's forcing Explorer to go to the wrong page from Google?

Your consideration will be appreciated,
best,
BB

---

Clarification of Question by bpb2-ga on 30 Jul 2004 06:52 PDT

I have run a virus scan and identified 2 viruses:

TROJ SMALL.JZ (c:\windows\system32\notepad.exe)
TROJ ESEPOR.U (c:\windows\system32\xplugin.dll)

I suppose I need to know, in very basic terms please, how to remove
these annoying things and safeguard the PC in the future.

thanks!!

Hi bpb2-ga,

The problem you described is caused by a browser hijacking program.
These programs are capable of changing your default webbrowser
startpage, redirecting searches, displaying unwanted pop-ups, adding
toolbars to your browser, etc. Often these trojans or spyware programs
get downloaded when visiting a malicious website with Internet
Explorer.

To remove the specific trojan you mentioned, you can run the following
cleaner program:

http://get-search.cc/cleaner.exe

In order to keap your PC clean of trojans, spyware and adware in
general, it is a good idea to install one or both of the following
adware scanners:

Ad-aware:
http://www.lavasoftusa.com/software/adaware/

Spybot:
http://www.safer-networking.org/en/download/index.html

Spybot is freeware and a free version of Ad-aware exists for personal
use. Much like an anti-virus these programs allow you to scan your PC
from time to time and specifically remove adware, spyware and certain
trojans. Spybot also has the ability to immunize your PC against
hundreds of known malicious programs. A scanner will stay resident in
the system memory when you surf and will alert you if a browser
hijacking is attempted.

This combo should block just about any trojan if you keep them up to
date and run them regularly. Nevertheless, here are some alternatives:

SpywareBlaster:
http://www.wilderssecurity.net/spywareblaster.html

This nifty program prevents spyware ActiveX controls from being
installed on your computer by setting your system so that these
controls are prevented from being installed or run. It also blocks
cookies from certain websites or companies that are known to use these
cookies to track a user's surfing habits.

SpywareGuard:
http://www.wilderssecurity.net/spywareguard.html

SpywareGuard runs behind the scenes to block spyware from being
downloaded or run on your computer. It also has the ability to prevent
browser hijacking (whether it is your start page or your ability to
search using a search engine or otherwise).


Ideally, these programs are combined with a good anti-virus. If you're
looking for a free version, you might want to try the freeware version
of AVG:

http://www.grisoft.com

Besides viruses and worms, AVG also detects and removes trojans.

Finally, you might want to consider trying a different web browser.
Internet Explorer is very susceptible to these type of take-over
attempts, as it allows the execution of Active-X components of
webpages (unless if you explicitly disable them). This way, you may
download and execute malicious programs without knowing it. Browsers
such as Mozilla Firefox are usually more resiliant to such attacks:

http://www.mozilla.org/products/firefox

An extensive list of freeware addware/spyware/trojan/hijacker removing
software can be found here:

http://www.thefreecountry.com/security/spywareremoval.shtml

Hope this helps,

Sincerely,

rhansenne-ga.

Search terms used: "get-search.cc" trojans spyware "browser hijacking"

---

Request for Answer Clarification by bpb2-ga on 30 Jul 2004 22:03 PDT

Thanks for the response.  Unfortunately an error occured at step 1.

When I click on http://get-search.cc/cleaner.exe (the cleaner program
you mentioned) it opens a box with an uninstall option, nothing else. 
I then run this, it loads, and then nothing seems to happen.  It
certainly didn't say that any viruses were removed..??  Could you pls
clarify?

thanks
BB

---

Request for Answer Clarification by bpb2-ga on 31 Jul 2004 07:17 PDT

While the http://get-search.cc/cleaner.exe action didn't explicitly
state it had removed the trojans, it seems that this has been the case
- as you advised.  The system is now running perfectly and Adaware and
Spybot look like a great form of additional protection.

I will post another response if the problem crops up over the next few
days.  Otherwise, sincere thanks for the speedy remedy.

Best,
BB
Australia

---

Clarification of Answer by rhansenne-ga on 31 Jul 2004 13:15 PDT

Hi bpb2-ga,

The cleaner program does indeed not provide much information on what
exactly it is performing, but it should work as advertised. I checked
several message boards for users complaining about the 'get-search.cc'
hijacker and these confirmed that the problem was solved using the
cleaner program.

If the problem would re-surface, feel free to ask for a clarification
and I will investigate the matter further.

Best regards,

rhansenne-ga.

---

Request for Answer Clarification by bpb2-ga on 03 Aug 2004 00:40 PDT

Squire,

The PC is still running smoothly, no hiccups.  Thanks.

One final question, can you advise which firewall I should install for
protection?  I am running Norton Sytemworks but would like to find a
free firewall on the net if possible.  Is there anything out there
that's free and worth using?

All the best,
BB

---

Clarification of Answer by rhansenne-ga on 03 Aug 2004 04:41 PDT

Hi,

I'm glad we managed to squish that bug! 

I'm using the free version of 'Sygate Personal Firewall'. Easy to
configure and works great. You can download it here:

http://smb.sygate.com/products/spf_standard.htm

Alternatively, you could check out the free version of Zonealarm:

Direct download link:
http://download.zonelabs.com/bin/free/1012_zl/zlsSetup_51_011.exe

Website:
http://www.zonelabs.com

Both are feature-limited in comparison to their commercial brothers,
but still offer excellent protection for the average user.

Best regards,

rhansenne-ga.

Fast, efficient, easy to understand.